# Permission Error

**URL:** <https://discuss.hail.is/t/permission-error/2835>\
**Category:** Hail Query & hailctl\
**Created:** [September 15, 2022, 4:06am UTC](https://discuss.hail.is/t/permission-error/2835 "2022-09-15T04:06:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![zhouhufeng](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.hail.is/zhouhufeng/32/535_2.png) [@zhouhufeng](https://discuss.hail.is/u/zhouhufeng)\
**Post date:** [September 15, 2022, 4:06am UTC](https://discuss.hail.is/t/permission-error/2835/1 "2022-09-15T04:06:45Z")

</div>

I seems to have access permission error with the following error message.  
But I do have access to the google bucket and the project,

hufengzhou$ gsutil ls fc-secure-7e69c896-d6c0-4a4e-8490-42cb2d4fdebf/ccdg\_exome\_203k.vds/  
can show the content

hailctl dataproc submit export1 CCDGF3MT2VCFEXOME.py

Submitting to cluster ‘export1’…

gcloud command:

{

“code” : 403,

“errors” : [ {

```
"domain" : "global",

"message" : "124652868343-compute@developer.gserviceaccount.com does not have storage.objects.get access to the Google Cloud Storage object.",

"reason" : "forbidden"

```

} ],

“message” : “[124652868343-compute@developer.gserviceaccount.com](mailto:124652868343-compute@developer.gserviceaccount.com) does not have storage.objects.get access to the Google Cloud Storage object.”

}

Java stack trace:

java.io.IOException: Error accessing gs://fc-secure-7e69c896-d6c0-4a4e-8490-42cb2d4fdebf/ccdg\_exome\_203k.vds/reference\_data

```
at com.google.cloud.hadoop.repackaged.gcs.com.google.cloud.hadoop.gcsio.GoogleCloudStorageImpl.getObject(GoogleCloudStorageImpl.java:2140)

```

File “/Users/hufengzhou/opt/anaconda3/lib/python3.9/asyncio/base\_events.py”, line 647, in run\_until\_complete

```
return future.result()

```

File “/Users/hufengzhou/opt/anaconda3/lib/python3.9/site-packages/hailtop/hailctl/dataproc/submit.py”, line 88, in main

```
gcloud.run(cmd)

```

File “/Users/hufengzhou/opt/anaconda3/lib/python3.9/site-packages/hailtop/hailctl/dataproc/gcloud.py”, line 9, in run

```
return subprocess.check_call(["gcloud"] + command)

```

File “/Users/hufengzhou/opt/anaconda3/lib/python3.9/subprocess.py”, line 373, in check\_call

```
raise CalledProcessError(retcode, cmd)

```

subprocess.CalledProcessError: Command ‘[‘gcloud’, ‘dataproc’, ‘jobs’, ‘submit’, ‘pyspark’, ‘CCDGF3MT2VCFEXOME.py’, ‘–cluster=export1’, ‘–files=’, ‘–py-files=/var/folders/kt/5d9qryss0bg9s43mmwyrm2\_80000gn/T/pyscripts\_1d5j0xic.zip’, ‘–properties=’]’ returned non-zero exit status 1.

---

<div class="post-metadata">

**Author:** ![tpoterba](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.hail.is/tpoterba/32/61_2.png) [@tpoterba](https://discuss.hail.is/u/tpoterba)\
**Post date:** [September 15, 2022, 1:30pm UTC](https://discuss.hail.is/t/permission-error/2835/2 "2022-09-15T13:30:26Z")

</div>

Permissions on the cloud are unfortunately a lot more complicated than institutional HPC clusters. The core issue here is that Dataproc clusters aren’t using permissions from your Google account, but rather from the **compute engine service account** for your billing project. That service account is listed in the error, [XXXX-compute@developer.gserviceaccount.com](mailto:XXXX-compute@developer.gserviceaccount.com). There are two solutions here:

1. Ask whoever owns the project where the data lives to grant storage object administrator privileges to your compute service account above. This is the preferred solution since it incurs no additional cost.

2. Use your Google account through `gsutil` to copy the data into a bucket owned by your project (or one where you can grant this service account privileges). This is a worse solution because it requires paying for two copies of the data.